If you're going to do something as intrusive as attaching the debugger interface to the process, you could just check to make sure the code isn't in malloc.